Help: trojan and god knows what else

Re: Ran smitfraudfix

Welcome to Major Geeks!

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 6
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6 Update 1

Is your copy of Spyware Doctor 5.1 a paid version or free trial? If free, uninstall it now.

Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O21 - SSODL: bxlrvps - {5D918471-C75E-46A1-95FA-2C96687E65A8} - C:\WINDOWS\bxlrvps.dll (file missing)
O21 - SSODL: alofkmn - {047EDFB4-84B3-4A58-81D9-EC1C044A643C} - C:\WINDOWS\alofkmn.dll
O21 - SSODL: KernelSrv - {a1cec409-6d19-4a15-ad4b-6ef79a384608} - C:\WINDOWS\Installer\{a1cec409-6d19-4a15-ad4b-6ef79a384608}\KernelSrv.dll

After clicking Fix, exit HJT.

Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

File::
C:\WINDOWS\alofkmn.dll
 
Folder::
C:\5735d522fde0ae4176eb9c14b7eca478
 
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bxlrvps"=-
"alofkmn"=-
"KernelSrv"=-

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!